Methods and Systems for Detecting Disparate Incidents in Processed Data Using a Plurality of Machine Learning Models

1. A system for detecting disparate incidents in processed data using a plurality of machine learning models, the system comprising: storage circuitry configured to store: a cross-platform profile comprising a single profile for a user that is used across multiple assets; a first machine learning model, wherein the first machine learning model is trained to detect known incidents of a first type in a first set of labeled telemetry data; a second machine learning model, wherein the second machine learning model is trained to detect known incidents of a second type in a second set of labeled telemetry data; and control circuitry configured to: receive native asset data, wherein the native asset data comprises asset data presented to the user during the user's interaction with an asset; extract telemetry data from the native asset data, wherein the telemetry data indicates a behavior, action, and/or state of one or more users in an in-asset environment corresponding to the asset data; store the telemetry data; retrieve user-specific data for the user from the cross-platform profile; determine a first incident sampling frequency based on known incidents of the first type in the user-specific data; determine a second incident sampling frequency based on known incidents of the second type in the user-specific data; sample the telemetry data at the first incident sampling frequency to generate a first feature input based on the telemetry data; input the first feature input into the first machine learning model; detect a first incident based on a first output from the first machine learning model, wherein the first incident is a first event in an asset related to the user's behavior; sample the telemetry data at the second incident sampling frequency to generate a second feature input based on the telemetry data; input the second feature input into the second machine learning model; and detect a second incident based on a second output from the second machine learning model, wherein the second incident is a second event in the asset related to the user's behavior; and input/output circuitry configured to generate for presentation, in a user interface, an incident recommendation, in the cross-platform profile for the user, based on the first incident and the second incident.

2. A method for detecting disparate incidents in processed data using a plurality of machine learning models, the method comprising: receiving native asset data; extracting telemetry data from the native asset data; storing the telemetry data; retrieving user-specific data for a user from a cross-platform profile comprising a single profile for the user that is used across multiple assets; determining a first incident sampling frequency based on known incidents of a first type in the user-specific data, the first type being included in a first set of labeled telemetry data; determining a second incident sampling frequency based on known incidents of a second type in the user-specific data, the second type being included in a second set of labeled telemetry data; sampling the telemetry data at the first incident sampling frequency to generate a first feature input based on the telemetry data; inputting the first feature input into a first machine learning model, wherein the first machine learning model is trained to detect known incidents of the first type; detecting a first incident based on a first output from the first machine learning model, wherein the first incident is a first event in an asset related to the user's behavior; sampling the telemetry data at the second incident sampling frequency to generate a second feature input based on the telemetry data; inputting the second feature input into a second machine learning model, wherein the second machine learning model is trained to detect known incidents of the second type; detecting a second incident based on a second output from the second machine learning model, wherein the second incident is a second event in the asset related to the user's behavior; and generating for presentation, in a user interface, an incident recommendation based on the first incident and the second incident.

3. The method of claim 2 , wherein the native asset data includes social network data indicating a relationship between the user and another user involved in the first incident, and wherein the first machine learning model uses the relationship to detect the first incident.

4. The method of claim 2 , wherein the telemetry data indicates a behavior, action, and/or state of one or more users in an in-asset environment corresponding to the native asset data.

5. The method of claim 2 , further comprising: retrieving asset-specific data from the native asset data; determining an asset type based on the asset-specific data; and determining a type of telemetry data to use for the first feature input based on the asset type.

6. The method of claim 2 , further comprising: retrieving asset-specific data from the native asset data; determining an asset type based on the asset-specific data; and determining a frequency to pull the native asset data from a data source based on the asset type.

7. The method of claim 2 , further comprising: determining a data storage period for a data source of the native asset data; and determining a frequency to pull the native asset data from the data source based on the data storage period.

8. The method of claim 2 , further comprising: retrieving asset-specific data from the native asset data; determining an asset type based on the asset-specific data; and determining an amount of down-sampling of the telemetry data based on the asset type.

9. A non-transitory, computer-readable medium for detecting disparate incidents in processed data using a plurality of machine learning models, comprising instructions that, when executed by one or more processors, cause operations comprising: receiving native asset data; extracting telemetry data from the native asset data; storing the telemetry data; retrieving user-specific data for a user from a cross-platform profile comprising a single profile for the user that is used across multiple assets; determining a first incident sampling frequency based on known incidents of a first type in the user-specific data, the first type being included in first set of labeled telemetry data; determining a second incident sampling frequency based on known incidents of a second type in the user-specific data, the second type included in a second set of labeled telemetry data; sampling the telemetry data at the first incident sampling frequency to generate a first feature input based on the telemetry data; inputting the first feature input into a first machine learning model, wherein the first machine learning model is trained to detect known incidents of the first type; detecting a first incident based on a first output from the first machine learning model, wherein the first incident is a first event in an asset related to the user's behavior; sampling the telemetry data at the second incident sampling frequency to generate a second feature input based on the telemetry data; inputting the second feature input into a second machine learning model, wherein the second machine learning model is trained to detect known incidents of the second type; detecting a second incident based on a second output from the second machine learning model, wherein the second incident is a second event in the asset related to the user's behavior; and generating for presentation, in a user interface, an incident recommendation based on the first incident and the second incident.

10. The non-transitory, computer-readable medium of claim 9 , wherein the native asset data include social network data indicating a relationship between the user and another user involved in the first incident, and wherein the first machine learning model uses the relationship to detect the first incident.

11. The non-transitory, computer-readable medium of claim 9 , wherein the telemetry data indicates a behavior, action, and/or state of one or more users in an in-asset environment corresponding to the native asset data.

12. The non-transitory, computer-readable medium of claim 9 , wherein the instructions further cause operations comprising: retrieving asset-specific data from the native asset data; determining an asset type based on the asset-specific data; and determining a type of telemetry data to use for the first feature input based on the asset type.

13. The non-transitory, computer-readable medium of claim 9 , wherein the instructions further cause operations comprising: retrieving asset-specific data from the native asset data; determining an asset type based on the asset-specific data; and determining a frequency to pull the native asset data from a data source based on the asset type.

14. The non-transitory, computer-readable medium of claim 9 , wherein the instructions further cause operations comprising: determining a data storage period for a data source of the native asset data; and determining a frequency to pull the native asset data from the data source based on the data storage period.